diff --git a/backend/tests/integration/test_failure_reason_vocabulary_migration.py b/backend/tests/integration/test_failure_reason_vocabulary_migration.py
index 4e03534de..acf1150cb 100644
--- a/backend/tests/integration/test_failure_reason_vocabulary_migration.py
+++ b/backend/tests/integration/test_failure_reason_vocabulary_migration.py
@@ -27,7 +27,9 @@ from backend.app.models.print_log import PrintLogEntry
 # The columns each model needs beyond ``failure_reason``. Rows stay minimal on
 # purpose -- these tests exercise the UPDATE, not the schema.
 _REQUIRED = {
-    "PrintArchive": {"filename": "x.3mf", "file_path": "/tmp/x.3mf", "file_size": 1},
+    # nosec B108 - a column value, not a path anything opens. The row exists
+    # to be UPDATEd; nothing in these tests touches the filesystem.
+    "PrintArchive": {"filename": "x.3mf", "file_path": "/tmp/x.3mf", "file_size": 1},  # nosec B108
     "PrintLogEntry": {},
 }
 
diff --git a/backend/tests/integration/test_notifications_api.py b/backend/tests/integration/test_notifications_api.py
index 149e059dd..e9596c16d 100644
--- a/backend/tests/integration/test_notifications_api.py
+++ b/backend/tests/integration/test_notifications_api.py
@@ -60,14 +60,21 @@ class TestNotificationsAPI:
         provider = await notification_provider_factory(name="Legacy Provider")
 
         flags = ["on_stock_reorder_alert", "on_stock_break_alert"]
+        # nosec B608 - the only interpolated fragments are built from `flags`,
+        # the literal list directly above. A column name cannot be a bind
+        # parameter, which is why it is written into the string at all; the id,
+        # which is the one caller-supplied value here, is bound.
+        null_assignments = ", ".join(f"{f} = NULL" for f in flags)
         await db_session.execute(
-            text(f"UPDATE notification_providers SET {', '.join(f'{f} = NULL' for f in flags)} WHERE id = :id"),
+            text(f"UPDATE notification_providers SET {null_assignments} WHERE id = :id"),  # nosec B608
             {"id": provider.id},
         )
         await db_session.commit()
 
+        columns = ", ".join(flags)
         stored = await db_session.execute(
-            text(f"SELECT {', '.join(flags)} FROM notification_providers WHERE id = :id"), {"id": provider.id}
+            text(f"SELECT {columns} FROM notification_providers WHERE id = :id"),  # nosec B608
+            {"id": provider.id},
         )
         assert all(value is None for value in stored.one()), "row under test must actually hold NULLs"
 
diff --git a/backend/tests/unit/test_vp_mqtt_bridge.py b/backend/tests/unit/test_vp_mqtt_bridge.py
index 597f7f26f..3816fba04 100644
--- a/backend/tests/unit/test_vp_mqtt_bridge.py
+++ b/backend/tests/unit/test_vp_mqtt_bridge.py
@@ -1983,7 +1983,7 @@ class TestAdvertiseAddressOverride:
     def test_wildcard_override_falls_through_to_auto_resolve(self, monkeypatch):
         """0.0.0.0 is a bind address, never a destination — treat it as unset
         rather than encoding it and sending the slicer to 0.0.0.0."""
-        monkeypatch.setenv(self.ENV, "0.0.0.0")
+        monkeypatch.setenv(self.ENV, "0.0.0.0")  # nosec B104
         bridge = self._bound_bridge("0.0.0.0")  # nosec B104
         with patch(
             "backend.app.services.virtual_printer.mqtt_bridge._resolve_host_interface_for_target",